CVE-2026-31727

{"id": "CVE-2026-31727", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7c97366f5dac5255e60a317ffe3a5b18f3745547", "lessThan": "f9f987472f4b8ab177be2b6492a59278ed969479", "versionType": "git"}, {"status": "affected", "version": "36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4", "lessThan": "7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2", "versionType": "git"}, {"status": "affected", "version": "93f116c3393a22acab96ad1bef12b2572eb80ca4", "lessThan": "0326429e8ba99892e1d1e115dc8e88e1a3b64e24", "versionType": "git"}, {"status": "affected", "version": "e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d", "lessThan": "a36e5e800b9c93e3e1ffa42f34d38b36775dbcee", "versionType": "git"}, {"status": "affected", "version": "85acaba2f42b557499bab3608307f17bf13beb69", "lessThan": "7de4d46be40738c7e48e64b5cc0a34aa1e047b0a", "versionType": "git"}, {"status": "affected", "version": "ec35c1969650e7cb6c8a91020e568ed46e3551b0", "lessThan": "e002e92e88e12457373ed096b18716d97e7bbb20", "versionType": "git"}], "programFiles": ["drivers/usb/gadget/function/u_ether.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12.78", "lessThan": "6.12.81", "versionType": "semver"}, {"status": "affected", "version": "6.18.19", "lessThan": "6.18.22", "versionType": "semver"}, {"status": "affected", "version": "6.19.9", "lessThan": "6.19.12", "versionType": "semver"}], "programFiles": ["drivers/usb/gadget/function/u_ether.c"], "defaultStatus": "unaffected"}]}], "published": "2026-05-01T15:16:35.210", "references": [{"url": "https://git.kernel.org/stable/c/0326429e8ba99892e1d1e115dc8e88e1a3b64e24", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7de4d46be40738c7e48e64b5cc0a34aa1e047b0a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a36e5e800b9c93e3e1ffa42f34d38b36775dbcee", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e002e92e88e12457373ed096b18716d97e7bbb20", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f9f987472f4b8ab177be2b6492a59278ed969479", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo\n\nCommit ec35c1969650 (\"usb: gadget: f_ncm: Fix net_device lifecycle with\ndevice_move\") reparents the gadget device to /sys/devices/virtual during\nunbind, clearing the gadget pointer. If the userspace tool queries on\nthe surviving interface during this detached window, this leads to a\nNULL pointer dereference.\n\nUnable to handle kernel NULL pointer dereference\nCall trace:\n eth_get_drvinfo+0x50/0x90\n ethtool_get_drvinfo+0x5c/0x1f0\n __dev_ethtool+0xaec/0x1fe0\n dev_ethtool+0x134/0x2e0\n dev_ioctl+0x338/0x560\n\nAdd a NULL check for dev->gadget in eth_get_drvinfo(). When detached,\nskip copying the fw_version and bus_info strings, which is natively\nhandled by ethtool_get_drvinfo for empty strings."}], "lastModified": "2026-06-19T13:16:27.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3567D859-58AE-4093-AF8D-4FAF8C4F6486", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.12.78"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFB8FEEE-92ED-46DD-897B-15F8534FE743", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.18.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F44F6C4F-96C5-4F3A-8DA1-9B8F6AB14C51", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}